PeerNest
A tutoring platform where the admin disappears.
The pipeline
A live lesson ends and the transcript, the summary, the homework and the invoice are already waiting. Multi-tenant from the first migration, because retrofitting isolation is a rewrite.
Everything in the pipeline runs in production today, including the parts that took three outages to get right. We would rather show you the system than a testimonial.
The choices that were expensive to reverse.
Why multi-tenant from the first migration?
Because retrofitting isolation is a rewrite. Every table carries an org boundary, so background jobs, webhooks and admin scripts are safe without a request context to read from.
Why durable workflows instead of background jobs?
A lesson pipeline runs for minutes and touches four external services. Fire-and-forget work inside a request handler dies when the request does. We learned that during an outage, not in design review.
Why an MCP server?
So the product is usable by an agent, not only by a browser. Fifteen intent-level tools, with money and email actions gated behind an explicit confirmation step.
What we would do differently
Separate the staging and production deployment pipelines on day one. Shared environment names cost us three separate incidents that all looked like different bugs.